Display error on plugin activation

Hi there, and I’m sorry you’re having trouble using the Plugin. I will try my best to sort you out.

What is the “funny text” at the top of your dashboard when you activate the Postman plugin? Please paste it here so I can see, or send me a screenshot to jason -at- hendriks -dot- ca.

DEBUG postman.php: Postman v1.3.4 starting Status: 302 Moved Temporarily X-Frame-Options: SAMEORIGIN Set-Cookie: PHPSESSID=087c31d5774d7709d56d8821bcd305cf; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: https://nidalap.com/wp-admin/plugins.php?activate=true&plugin_status=all&paged=1&s= Content-type: text/html DEBUG PostmanWpMailBinder: Not binding, plugin is not configured. DEBUG PostmanAdminController: Registering wp_ajax_test_port Ajax handler DEBUG PostmanAdminController: Registering wp_ajax_check_email Ajax handler DEBUG PostmanAdminController: Registering wp_ajax_get_redirect_url Ajax handler DEBUG PostmanAdminController: Registering wp_ajax_send_test_email Ajax handler DEBUG PostmanAdminController: Registering admin menu generateDefaultContent DEBUG PostmanAdminController: Registering test_mail Action Post handler DEBUG PostmanAdminController: Registering purge_data Action Post handler DEBUG PostmanActivationHandler: Activating plugin DEBUG postman.php: Normal exit

Above is the funny text I got after I click “activate this plugin”. Below is the funny text I got on top of my dashboard if the plugin is activated:

DEBUG postman.php: Postman v1.3.4 starting DEBUG PostmanWpMailBinder: Not binding, plugin is not configured. DEBUG PostmanAdminController: Registering wp_ajax_test_port Ajax handler DEBUG PostmanAdminController: Registering wp_ajax_check_email Ajax handler DEBUG PostmanAdminController: Registering wp_ajax_get_redirect_url Ajax handler DEBUG PostmanAdminController: Registering wp_ajax_send_test_email Ajax handler DEBUG PostmanAdminController: Registering admin menu generateDefaultContent DEBUG PostmanAdminController: Registering test_mail Action Post handler DEBUG PostmanAdminController: Registering purge_data Action Post handler Set-Cookie: PHPSESSID=c01b6d86c803616dd3cfd4ae9598650c; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Frame-Options: SAMEORIGIN Content-Type: text/html; charset=UTF-8

Is this a production website? You have debug enabled. This is a GIANT security hole in your website. Passwords, internal configuration, version numbers, all kinds of things are potentially available to would-be attackers, Google, etc. Turn off debug and see if your problems go away.

As for Postman, Ajax calls will break if your PHP is pumping random debug statements into your HTML, and Postman uses quite a bit of Ajax.

I have debug enabled in my TEST environment, but I write everything to disk, not out to HTML. This is the proper way to briefly enable debug in a production environment:

define('WP_DEBUG', true);
define('WP_DEBUG_LOG', true);
define('WP_DEBUG_DISPLAY', false);

Edit: Also check your PHP Configuration, PHP may be configured to pipe debug output to HTML with the display_error parameter.

Below is the funny text when I click “request permission from google”:

DEBUG postman.php: Postman v1.3.4 starting DEBUG PostmanWpMailBinder: Not binding, plugin is not configured. DEBUG PostmanAdminController: Got $_REQUEST action oauth_request_permission DEBUG PostmanAdminController: Registering init function handleOAuthPermissionRequestAction Status: 302 Moved Temporarily Set-Cookie: PHPSESSID=c4a5e8adb9dc342f3f7d3aa37fe3452d; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: https://accounts.google.com/o/oauth2/auth?response_type=code&redirect_uri=http%3A%2F%2Fnidalap.com%2Fwp-admin%2Foptions-general.php%3Fpage%3Dpostman&client_id=282314133269-fv0ohd6gabdc7oqf13knf5eqdc6t3j0l.apps.googleusercontent.com&scope=https%3A%2F%2Fmail.google.com%2F&access_type=offline&approval_prompt=force&state=a48cf51538415fe13bcbc5458f9ccd78&login_hint=adminnidalap.com Content-type: text/html DEBUG PostmanAdminController: handling OAuth Permission request DEBUG PostmanAuthenticationManagerFactory: Created PostmanGmailAuthenticationManager DEBUG PostmanGmailAuthenticationManager: Requesting verification code from Google DEBUG postman.php: Redirecting to ‘https://accounts.google.com/o/oauth2/auth?response_type=code&redirect_uri=http%3A%2F%2Fnidalap.com%2Fwp-admin%2Foptions-general.php%3Fpage%3Dpostman&client_id=282314133269-fv0ohd6gabdc7oqf13knf5eqdc6t3j0l.apps.googleusercontent.com&scope=https%3A%2F%2Fmail.google.com%2F&access_type=offline&approval_prompt=force&state=a48cf51538415fe13bcbc5458f9ccd78&[email protected]’ DEBUG postman.php: Normal exit

I follow the wizard setup but it stuck on step 3 when checking ports. nothing happens.

Yes, it is a production site.

My wp-config.php file has this line written:

define(‘WP_DEBUG’, false);
define(‘WP_DEBUG_DISPLAY’, false);

Shouldn’t it already mean no debug and no debug display?

The port test uses Ajax, and Ajax can’t work if the debug messages are being sent in the HTTP response.. the browser just ends up seeing ‘noise’ — exactly what you see — and can’t find the port test response.

The same thing happens with the Request from Google link. Postman writes a Location header, but the debug output prematurely truncates the header calls. The browser can’t interpret the redirect instruction.

You need to disable printing your debug output to your HTML. Did you check your php.ini file? Look for option ‘display_errors’ and make sure it is set to off.

I could possibly send you a patched Postman that with all the debug turned off, but there is a greater security issue here. Imagine a plugin dumped something sensitive like a password into the debug log and it ended up on Google as it crawled the site.

I use phpinfo and I saw:
display_errors local value:On master value:On

The hosting says I could not view nor edit the default php.ini. But it says I could create a custom one for my domain to override the default setting and put it in a certain directory of my hosting.

Could you please show me what code to write in the custom php.ini file so I could get rid of the display error and get the plugin to hopefully work? Thanks in advance!

After you make a copy of your host’s default php.ini, find the line display_errors and set it to off.

; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; It's recommended that errors be logged on production servers rather than
; having the errors sent to STDOUT.
; Possible Values:
;   Off = Do not display any errors
;   stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
;   On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; https://php.net/display-errors
display_errors = Off

How do I make a copy of my host’s default php.ini if couldn’t even view it?

That’s a question for your host, not for me. They can tell you where the default php.ini is or send you a copy if you don’t have access to it.

Here’s one on the web, but who knows if it’s compatible with your version of PHP.
https://www.reallylinux.com/docs/php.ini

ok, my php info already showing the display_errors is off. but still I see the funny text above the header when I activate your plugin. Any idea?

Really?? No I’m out of ideas. That should have done it.

I’ll send you a version of the plugin with all the debug code removed.